Siri, are you a security hole? And have you met Iris, your Android sister?

Sophos points to weakness in iPhone's voice-driven 'assistant' that could let people access personal details such as phone numbers and addresses. Meanwhile developers write an Android clone – or near-clone

Siri, the voice-driven assistant on Apple's new iPhone 4S, poses a security risk according to Sophos, which has pointed out that its default setting would allow it to be used to send emails and texts even while the screen is locked with a passcode.

Graham Cluley, security consultant at Sophos, points out that he was able to do both those things, and could have meddled with the colleague's calendar appointments, even while the phone ostensibly remained locked.

Cluley points out that there is a setting that can prevent Siri being accessed unless the screen is unlocked with the passcode. However, the default setting on the phone leaves it on – and given Siri's ability to be used with any voice, and to provide personal details from the address book, it would be possible for someone who'd stolen a Siri-enabled phone to extract valuable details even while not being able to get beyond the lock screen.

Siri on the iPhone 4S is enabled by default even with a lock screen. Screenshot: Sophos guardian.co.uk

Apple has said that in its present form Siri, which requires network access to function, is a beta. It is not yet clear whether greater security – which might include an "unlock word" or specific voice recognition tied to the owner – or more robust defaults will be included in the future.

Cluley says: "What's disappointing to me though is that Apple had a clear choice here. They could have chosen to implement Siri securely, but instead they decided to default to a mode which is more about impressing your buddies than securing your calendar and email system. It's not as though Siri impressed me enormously anyway during my brief play with it: 30% of the time it misinterpreted what I was trying to say."

Google's newly announced version of Android, "Ice Cream Sandwich" (4.0), includes a new "facial recognition" lock and unlock feature using the phone's front camera which can be used to authenticate a user. However, there is no announcement so far of any Siri-like functionality beyond the Google Voice Search built into Android phones.

Google's head of mobile Andy Rubin was mostly dismissive about the implications of Siri. Speaking at the AllThingsD conference in Hong Kong, he said: "Your phone is a tool for communicating. You shouldn't be communicating with the phone; you should be communicating with somebody on the other side of the phone." He suggested that he wasn't sure what penetration Siri would get. He added: "This isn't a new notion… In projecting the future, I think Apple did a good job of figuring out when the technology was ready to be consumer-grade."

However, some third-party developers for Android clearly think Siri is a feature worth incorporating. A team from Dexetra.com has written "Iris" – Siri, spelt backwards – which uses Google's speech-to-text system to provide Siri-like functionality for Android phones by querying Wikipedia or other reference sites for topics such as art, literature, history and biology. According to TechCrunch, Iris – coded in an eight-hour blast – is due to be released soon on the Android Marketplace, although an alpha version is already available. Iris requires both Google Voice Search and its text-to-speech library to be installed, though almost all Android phones have these pre-installed. Early responses are encouraging, though some say it "takes a lot of time to reply", and early ratings vary widely, from five stars to one star, running roughly 3-2 at four stars and above v two stars or less.